http://wordpress.org/support/topic/39328 "I don't know if this is to be considered a bug, but anyone can read your drafts simply by entering the post number to the url by hand." Not seen this reported before.